Please take our victim survey on Pollfish to help us better understand online threats targeting the public. One of the best ways for you to stay informed and recognize online threats is by helping to build a list of scammer websites, and check out the list from time to time. 

Unless you are living under a rock, you’ve likely heard about online AI services that can easily create content for people or provide answers to questions in seconds. (But some of these answers contain false information!) For example, the AI service called ChatGPT.  According to ConsumerAffairs.com, there is a similar AI service called wormGPT built specifically for scammers to use, increasing the risks to all of us!

Can You Trust This Political Polling Service? — It is impossible to avoid the news stories across the world about the recent U.S. Republican Party candidate debate, or the indictment of 19 people in Georgia, including a former President, for their alleged involvement in overturning the 2020 Presidential election. And then, unexpectedly, a TDS reader sent us a screenshot of an invitation to take a political poll (survey). “Your Opinion Matters!” it said. It came to her via a text from an unknown number, +1 (413) 343-1015. She thought it was spam and sent it to us. We didn’t think much of it until we explored the business domain name shown in the text. The reviews and accusations about this polling service were not what we expected to find! Regardless of your political leanings, we think you should take a walk along this knife’s edge as we show you what we found about a seemingly simple, straight forward political survey.

On the evening of August 24, a Massachusetts woman received the text below. After the cleverly designed image of the megaphones, the text says “Hi, this is Research-Polls!” The link provided clearly points to the domain research-polls[.]com. A search for the 413 phone number in Google turned up absolutely nothing. Is this just a routine, random unsolicited poll? Can the designers of this data collecting device be trusted and should you offer your opinion? A little digging into this data-collecting service informs us that the answers to these questions are not so simple.

We asked our usual tools to evaluate whether or not the link in that text to Research-polls[.]com was malicious. The Sophos security service shown on Virustotal.com identified it as spam, but none of our services identified it as malicious or even suspicious. However, Sucuri.net informed us that this link will redirect visitors to another domain called Research-opinions[.]com.  The domain research-polls[.]com was registered on April 21, 2022, while the research-opinions[.]com is older and was registered through the same Registrar (Amazon) in January, 2019. The age of these domains suggest that the associated websites are likely legitimate.

You might wonder, what’s all the fuss? The United States is entering a political season, and this is likely just another political poll, right? However, this unsolicited text from an oddball phone number piqued our interest and we decided to check the reputation of this domain with a variety of sites. We got mixed reviews.  Both isLegitSite.com and WebParanoid.com report that Research-Polls[.]com is “potentially legitimate” and can be trusted. However, Scam-Detector.com gives research-polls[.]com a low trust rating, calling this site “debatable,” “contentious” and “controversial.”  Two of the points made by Scam-Detector are that research-polls[.]com “is poorly designed and doesn’t contain elements in the metadata that could help its online presence.”  “Poorly designed” is clear but the second criticism may not be to our readers. “Metadata” are hidden elements built into a website that help search engines understand what the website is and what that website wants search engines to know about it. This routinely includes a title and a description of the website. Apparently, Research-Polls[.]com contains no meta data for search engines to note.  When we conducted a Google search for the phone number listed exactly as it appears on the Research-polls[.]com website or in the more standard phone number format, Google found nothing. When we asked Google to search for the Fort Lauderdale, Florida address listed on their website, Google couldn’t show the research-poll[.]com business listed there. In fact, Google doesn’t include their polling business in its first 57 links that show up in the Google returns. (We stopped counting at 57.)

More importantly, we found lots of poor and sketchy reviews of their website, as well as a few articles written about this polling site that questions its legitimacy and neutrality. The biggest concern, as far as we could see, is that many people have described the polls they were invited to take as biased or with “an agenda.”  For example,  on Scamdoc.com we found 22 reviews, most of which were posted in 2022. The average rating is 1.3 stars out of a possible 5. Many of the reviews say that they felt the survey questions expressed an inherent bias. A response from a woman listed as Jan in January, 2022 summed up the sentiments of many quite well. She said “I tried to answer questions to see how legit it is – some were ok but then it came to statements attributed to a known political figure, and the statements were outrageously extreme, and completely false. And the picture they gave of the clearly favored aspiring politician were obviously an ad-for the GOP.  Disgusted is putting it mildly.” Ironically, other reviewers felt that the bias of the survey questions favored the Democrats or Liberals! Also, a few people mentioned that their “STOP” requests were ignored and they continued to get texts from this polling service even though they asked it to stop.

We noted that there were articles online that were also suspicious that this polling service had an agenda or was biased. This included a blog called EarningABit.com. The author added “There are so many red flags indicating that the website is not legit.” In October, 2022, the Dakota Free Press did a full article about this polling service after one of their citizens reported it to them. It’s a long article with lots of screenshots from a South Dakota survey but near the bottom were some interesting takeaways about the types of questions being asked, some of them poorly. The article closes with an interesting statement… “The original text invitation claimed that Research Polls was interested in how things are going in our state, but not one question dealt with any issues specific to South Dakota. This poll, like Kristi Noem (Governor of S. Dakota), seems uninterested in the details of events and policy in South Dakota and far more interested in identifying messages that will help Noem win one more election.”  This concluding remark seemed consistent with some of the other comments we saw in the Scamdoc reviews.

We are certainly not calling Research-Polls[.]com a scam. However, we saw a number of red flags that lead us to suspect that this polling service **may** have an agenda or that their polls are biased depending on who is funding them.  Some of the things that bothered us include…

• Why doesn’t their website list the owners or names of anyone behind this data-collecting company? 
• Why do their links redirect to other domains such as research-opinions[.]com and viewpointpoll[.]com?  None of these domains list Research Polls as the owner. All domain ownership is hidden behind a proxy service.
• Why is it that the Research Poll physical address, listed on their website as 508 Hendricks Isle, Fort Lauderdale, Florida, appears to be a residential apartment building and not an office building or business? (Zillow shows apartments at this address.) 

There are many good reasons why it is important for the public to express their opinions to those in politics, or to those who make policies that impact the public. However, we feel that clarity, integrity, unbiased data collecting and honesty are critical to this process. We’re not confident that this is the case with the people, business or motivating circumstances behind Research-Polls[.]com. If that unsolicited survey text lands on our phone, we’re hitting delete.

Scammers Impersonating Meta! — Scammers have recently been impersonating Meta and targeting Facebook business/community page owners with a scam known as the Meta business support scam. Check out and protect yourself with this 100%  FREE, all-in-one tool.

Sometimes signs of fraud are both subtle and screamingly obvious at the same time! Like in this next email that came to us at The Daily Scam. Never mind that we don’t sell what Mr. Sabrungthawee is buying. Can you look at the details of his email and spot the ONE piece of evidence that screams FRAUD?  The answer is just below….

As we say, over and over…. Details matter!  Mr. Phuangthong Sabrungthawee claims to be the Customer Account Specialist for Exxon Mobile Limited in Thailand. But he didn’t send his email from exxonmobil.com! He sent his email from a malicious mimic called exnmobil[.]com!  This look-alike domain was registered in Lithuania just 2 weeks earlier and Google knows nothing about it.  Deeeeeeeleeeeete!

One of our Massachusetts residents sent us this voice message that she received from “Jenny” at the “Financial Hardship Loan Center” of Boston. Jenny sounds like a caring, younger woman calling to inform the resident about a $36,000 loan available to her. But there is no such office as the “Financial Hardship Loan Center.” This scam call has been well documented and lots of people reported this fraudulent call on Reddit in 2022. In April of this year, Vice News even reported on this scam. It appears there is a “hefty fee” to apply for the loan and the loan never comes through.  And if you think Jenny sounds like a nice, empathetic young lady, you’re wrong! According to multiple sources, including the Vice News article, the voices in these phone calls are generated by AI and are not real. Hard to believe when you listen to “Jenny”….

Scamadviser, Ebrand and the Danish Registry have just launched a new Anti-Scam Platform!  It’s a great resource. For example, you can use it to check a website’s reputation.  Check it out on the Ebrand site.

The recent hurricanes and tropical storms that hit California and Texas, just like the fires of Maui, Hawaii, have spawned a variety of scam charities to collect your money.  Check out this article about these scams on the Consumer FTC US Government website…

https://consumer.ftc.gov/consumer-alerts/2023/08/potential-scams-following-tropical-storm-hilary-southern-california-and-western-states

Office 365, Xfinity Upgrade, and Mailbox is Full — One of our readers who is an accountant received an email from “MS Support” but it came from a server in Brazil! The sender says he’s looking for someone to manage their capital investments and financial resources. But the sender includes a pdf document with a bogus link! The document tells the accountant that his Office 365 password has expired.  This is complete nonsense and, thankfully, the accountant agrees!

Another TDS reader received this lovely email last weekend thanking him for requesting an “upgradation” to his Xfinity account. Notice that this phishing email tells the recipient that “this request can’t be reversed until you contact our representative.”  The contact number provided, 888-969-5596, is NOT the phone number of Xfinity (or Comcast) support.  It’s a scammer’s number that has been reported on the Internet multiple times, including on Robokiller.com and 800notes.com. Delete! 

We, at The Daily Scam, are targeted by scammers almost daily! (Hence the DAILY scam!)  On August 16 we received a very concerning email that one of our account mailboxes was almost full! Oh dear! Nevermind the fact that the email came from an auto glass company website in Colorado that has been hacked and misused. The link to upgrade our mailbox size pointed to a malicious website that we’ve seen many times before….infura-ipfs[.]io. 

VirusTotal is also VERY familiar with this malicious website. Eight security services have identified this site as nasty! Once again, we sprung into action and modified that dangerous link, telling the scammers EXACTLY what we thought of their little ruse! Given the way their phishing site tools recreated the login for the email we offered, it is clear that the senders of this scam are the same low-life human beings who have tried to target us for months. We actually think that there is a good chance they subscribe to this newsletter! And so, to them, we say… That’s the finger! (And if you don’t know what it means, Google it!)

Delta Airlines and CVS — You may think your opinion is important to the sender of this malicious clickbait but you would be wrong. It’s your CLICK that’s important because it’s the first step to collecting your personal information for scammers. There is no $100 reward coming to you from this email. Perhaps most misleading, is the fact that the GoogleApis.com service got misused again to send you this stinky phish. Virustotal.com says that at least one security service sees this as a phishing scam. This email came from an unpronounceable crap domain that was registered just 2 days earlier through that horrible Registrar called Namecheap!

If we had $5 for every “Answer & Win” bogus email we saw, we could retire! This one pretends to represent the pharmacy chain called CVS. Notice the poor subject line! (Details matter, remember?) The link in this clickbait points to a malicious website we last reported on in our August 9 newsletter.  VIPGadget[.]store was registered through Namecheap (**sigh**) and is hosted on a server in Morocco. You know what to do!

Suspicious Virus Detected — Another TDS reader sent us this warning he received in his inbox. “(5) Suspicious viruses are detected.” But did this warning come from Google (as seen in the email) or from Avast Security (as seen in the FROM text field)?  Surprise! This clickbait came from a server in Turkey! Once again, the cybercriminals who sent it are misusing the AmazonAWS service.  Deeeeleeeeete!

Lots of Delivery Texts! — During the last few months, our readers, friends and family have all reported an explosion of bogus text messages disguised as various deliveries that were delayed or unable to be made for various reasons. They are ALL clickbait and, given that the links of the first two are very similar, we’re confident that all of these texts are being sent by the same cybercriminal gang. 

They want you to think that they all represent the United States Postal Service (USPS.com) but NONE of the links point to this service and the texts didn’t come from it. The second text below actually was sent from a phone number in Thailand! Many of these malicious texts end with “The USPS Team wishes you a wonderful day!” indicating they were created by the same cybercriminal gang. In reality, that statement is the opposite of the truth!

Online scams are the most reported type of crime. Most countries now state that between 20 to 50% of all crimes reported are related to online fraud. This is only the tip of the iceberg, as only 7% of all scam victims report the crime to law enforcement. With nearly $55 billion lost last year and more than 300 million consumers scammed fast action is required.

On October 18–19, 2023, the 4th Global Anti-Scam Summit (GASS) will take place. The goal of the GASS is to bring governments, consumer & financial authorities, law enforcement, brand protection agencies, and (cybersecurity) companies together to share knowledge and define joint actions to protect consumers from getting scammed.

In 2022, we had nearly 1,300 virtual guests and 120 physical participants from 70+ countries. This year the event will be organized hybrid again. Last year, we defined 10 Recommendations to Turn the Tide on Scams. This year, we will focus on further defining these solutions and showcasing the best practices from around the globe.

Schedule  |  Book Tickets

October 18-19  |  Ramada by Wyndham Lisbon Hotel, Portugal & Online (Zoom)

Until next week, surf safely!

Copyright © 2023 The Daily Scam and Scamadviser. All rights reserved. You are receiving this email because you
have subscribed to it via Scamadviser.com or thedailyscam.com

Keurenplein 41, UNIT A6311  |  1069CD Amsterdam, The Netherlands

Contact Webmaster